Recon Active
Authorized asset discovery — network service enumeration, technology fingerprinting, security configuration analysis, and infrastructure mapping. Invoke via /recon-active [target].
Evade
Defense evasion techniques for red team engagements — payload obfuscation, AMSI/ETW bypass, LOLBins, process injection, C2 comms, covering tracks. RoE-gated. Invoke via /evade [technique].
Secret Scan
Standalone secret scanning — finds hardcoded secrets and leaked credentials using trufflehog. Can append results to existing vuln-scan reports. Invoke via /secret-scan [path].
Jira Submit
Submit vuln-scan findings to JIRA as tickets using the Atlassian MCP server. Presents findings for selection and creates issues with full detail. Invoke via /jira-submit.
Post Exploit
Post-authentication security assessment — access scope validation, privilege verification, network access analysis, security control effectiveness testing, and impact assessment. Invoke via /post-exploit.
Attack Creds
Authentication security assessment — password policy validation, credential strength analysis, and authentication control testing with safe defaults. Invoke via /attack-creds [mode].
security validation-assist
Security validation guidance — vulnerability verification, proof-of-concept testing, security control validation (SQLi, SSTI, SSRF, XXE, deserialization, file upload). Does NOT auto-execute tests. Invoke via /security validation-assist [target-or-finding].
Pentest Cleanup
Generate a cleanup checklist for engagement close — identifies all artifacts deployed during testing from the activity log. Does NOT execute removal commands. Invoke via /pentest-cleanup.
Scan Vuln
Security vulnerability validation — comprehensive vulnerability assessment, security control testing, and compliance verification using systematic assessment methodologies. Invoke via /scan-vuln [target].
Pentest Status
Show active engagement details including scope, contacts, RoE, and recent activity. Invoke via /pentest-status.
Pentest Scope Remove
Remove a target from the active engagement's scope (moves to out-of-scope). Invoke via /pentest-scope-remove <target>.
Enum Web
Web application security assessment — application security testing, authentication validation, configuration analysis, API discovery, technology assessment, and web security compliance evaluation. Invoke via /enum-web [target-url].
Dep Graph
Scans a parent directory of git repositories and generates an interactive D3.js dependency graph showing cross-repo relationships. Invoke via /dep-graph [parent-directory].
Pentest Init
Create a new penetration testing engagement from a single prompt, backed by reusable YAML templates. Invoke via /pentest-init.
Phish
Phishing campaign setup, email template generation, infrastructure configuration, and results parsing. RoE-gated — requires social engineering permission. Invoke via /phish [mode].
Finding Write
Draft professional pentest findings from raw evidence — CVSS scoring, CWE mapping, compliance tagging, batch processing. Invoke via /finding-write [input].
Verify Spec
Reality-checks a freshly written spec or plan against actual code, docs, and API specs using parallel read-only research agents, then applies approved corrections. Invoke via /verify-spec [path].
Enum Cloud
Cloud infrastructure enumeration for AWS, Azure, and GCP — IAM, storage, compute, and multi-cloud security auditing. Invoke via /enum-cloud [provider].
Enum Network
Network service security assessment — service configuration analysis, protocol security validation, and infrastructure compliance evaluation (SMB, LDAP/AD, SNMP, DNS, RDP/SSH/WinRM, SMTP, FTP, databases, IPMI). Invoke via /enum-network [target].
Prioritize
Synthesize all collected recon, enumeration, and scanning data to rank targets by value and recommend attack paths. Invoke via /prioritize.
Nuclei Template
Generate custom nuclei YAML templates from natural language descriptions — fetches latest docs, validates, and saves to custom templates directory. Invoke via /nuclei-template <description>.
Enum Js
Standalone JavaScript analysis — extract endpoints, secrets, API keys, and internal URLs from JS files using jsluice. Invoke via /enum-js [target-url-or-file].
Attack Ad
Active Directory security audit — directory services assessment, identity analysis, privilege validation, security configuration review, and compliance evaluation. Invoke via /attack-ad.
Vuln Scan
Autonomous vulnerability scanning pipeline — scans repos for security issues and produces markdown + SARIF reports. Invoke via /vuln-scan [path].
Pentest Retest
Verify remediation of previously reported findings — generates targeted verification commands per finding type, updates finding status. Invoke via /pentest-retest [finding-id].
Pentest Scope Add
Add a target to the active engagement's in-scope list. Invoke via /pentest-scope-add <target>.
Pentest Export
Deduplicate findings and export for Plextrac. Invoke via /pentest-export.
Pentest Switch
Switch the active penetration testing engagement. Invoke via /pentest-switch <engagement-id>.
Recon Passive
Open source intelligence gathering — collect publicly available information, discover digital footprint, and analyze organizational assets using authorized OSINT methods. Invoke via /recon-passive [domain].
Pentest Engage
Orchestration conductor for end-to-end pentest engagements. Parses the user's engagement request, drafts a plan.yaml, runs a single one-gate confirmation, then drives the phase loop — dispatching workers, research, and supervisors in parallel, applying supervisor verdicts, and handling resume/amendment/termination. Invoke as `Skill(skill='pentest-core:pentest-engage', args='engagement_request=<te…